but bcrypted passwords seems like it is towards the top of the list. And emailing password reset links instead of passwords

Absolutely!

But The Monastery is littered with similar suggestions. They usually amount to it being a "good idea" but nobody has the resources (skills, access, time, etc) to actually shoehorn it into the existing architecture.

It seems to me that a rewrite would be an easier solution and then to either port all the existing for existing threads in or else keep the existing site as an archive. After all, the core parts of PM are not exactly difficult to create...